| Affected | Telegram Desktop through 7.2.8 (Windows 6.9.3 confirmed) |
| Impact | Remote arbitrary local file read → session exfiltration → account takeover |
| CVE | CVE-2026-107181 |
| Fixed in | 7.2.9, commit db3405699f |
| Severity | 8.1 High CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N |
Chain: single-instance IPC serializes URLs as OPEN:<url>; without escaping semicolons → injection splits commands. Second bug: internal interpret: URI reads instruction files and sends arbitrary local files to attacker-controlled channels without authorization.
Attack: attacker adds victim to supergroup, auto-downloads instruction .txt files, victim clicks https link redirecting to crafted tg:// with stacked OPEN:interpret: paths to steal tdata/key_datas, encrypted session files, and maps index; rebuild tdata for session hijack (worse if no local passcode).
Mitigations: upgrade 7.2.9+; disable auto-download; restrict group invites; set local passcode.
Timeline: reported ZDI 2026-06-25; vendor fix 2026-09-16; 7.2.9 published 2026-09-17; writeup 2026-10-03; CVE assigned 2026-10-07. Fix removes interpret scheme and escapes IPC separators.